For CISOs & security leaders
Everything a CISO checks daily — in one place.
“I have to explain this to the board on Thursday.”
Tuesday morning: Six consoles, a spreadsheet, and a slide deck that is out of date before it is presented.
They search for:
security posture dashboardboard reporting security metricsCISO dashboard
How CMDash answers it
One screen instead of six tabs
The posture grade, integration health and compliance progress, together — the thing you actually open first Tuesday morning.
The trajectory, not a snapshot
The board’s real question is whether the programme is improving. The maturity score is computed from live control state, so the trend line answers it without a narrative built the night before.
The board pack, assembled from what is already true
A board-ready export built from the same live data as the dashboard — not a slide deck someone rebuilds by hand the morning of the meeting.
Watch: a CISO morning check-in
- 0:00A CISO's morning check-in, in a silent minute. Everything shown is a seeded demo workspace.
- 0:08Start where the day starts. Posture, integration health and open risk on one screen.
- 0:17The posture grade, broken into the weighted signals it is computed from — not a number you take on faith.
- 0:27The risk register, scored by likelihood and impact and ready for the standup before you open a spreadsheet.
- 0:37The board pack, assembled from that same live data — not rebuilt by hand the morning of the meeting.
- 0:45The trend line the board actually asks about: is the programme improving, day by day?
- 0:52Pricing is public and the trial is self-serve. Everything shown was sample data in a demo workspace.
Frameworks a security leader reports on
NIST Cybersecurity Framework 2.0
The current CSF, including the GOVERN function. Used as the hub other frameworks crosswalk through, so evidence you map once counts in more than one place.
ISO/IEC 27001:2022
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
SOC 2 Type II
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
CIS Controls v8.1
The prioritized safeguard set, useful as a starting programme when a formal certification is not the goal.
Where the evidence comes from
CrowdStrike Falcon
Pulls managed hosts, detections, and host vulnerabilities from Falcon so endpoint-protection controls are evidenced by live agent coverage rather than a spreadsheet.
Splunk Enterprise Security
Notable events from Splunk ES, plus correlation-search coverage that shows which ATT&CK techniques you can actually detect.
Okta
MFA enrolment and factor coverage, suspicious sign-in events, and the SaaS app catalog — the broadest identity signal cmdash ingests.
AWS Security Hub
Findings and compliance-standard results from Security Hub, so AWS control state is evidence rather than a screenshot.